Mac scareware gang evades Apple's new anti-malware defenses
Within hours of Apple's security fix, new fake security scam appears
Computerworld - The gang responsible for a month-long plague of fake Mac security software has already updated their "scareware" to evade defenses Apple put in place late Tuesday, a security company confirmed today.
"Apple's [antivirus] did not detect the new sample," said Peter James, a spokesman for Intego, a French firm that develops Mac security software.
According to James, the new malware file is identified as "mdinstall.pkg" and if installed, plants the phony MacGuard software on the victim's Mac.
Intego confirmed what ZDNet blogger Ed Bott reported earlier Wednesday, that the scammers had created a new version that wasn't detected by Apple's new defenses.
"This isn't surprising, that there's a new variant out almost as soon as Apple released its security update Tuesday," said James. "[The attackers] are following the news, they're efficient."
On Tuesday, Apple released an update for Mac OS X 10.6, aka Snow Leopard, that warns users that they've downloaded fake Mac security software and scrubs machines already infected with the scareware.
Also called "rogueware," scareware is bogus security software that claims a computer is heavily infected with worms, viruses and other malware. Once installed, the worthless program nags users with pervasive pop-ups and fake alerts until they fork over a fee. MacDefender, the generic name for the new series that targets Macs, demands $60 to $80 to cease and desist.
Intego first reported MacDefender in early May, but since then several variants have appeared, including MacGuard, which installs without requiring a password.
The new MacDefender appeared only hours after Apple issued its update yesterday, said James.
"They'll keep doing this," James predicted, referring to the cat-and-mouse game between the hackers who create MacDefender and Apple's efforts to block them.
"It's worked well enough that they're making money off it, or they wouldn't be doing this. Coming out with a new version right after the update, and a new version as soon as Apple announced it was going to release an update, shows that they're planning on staying on top of things," James said.
The move would not have surprised another researcher.
In a Tuesday interview, Chet Wisniewski, a security researcher with U.K.-based Sophos said Apple's update would either accelerate the race or the hackers would give up.
"If they keep doing [MacDefender], it implies they are succeeding at making money," said Wisniewski. "If Apple is able to stymie [MacDefender] 90% of the time or better, does that mean the bad guys will give up or up the ante?"
It seems that they've done the latter, which in James' eyes, wasn't that difficult.
"Apple's defense is signature-based," said James, talking about the antivirus tactic that relies on individual "fingerprints" of each piece of malware for detection. "Part of the new variant's code is the same, but part of it is different."
- Apple preps final non-security Mavericks update
- New Yosemite dev preview may herald public beta update later this week
- iPhone 5C's China bust raises questions about Apple's pricing for '14 models
- Mac sales so far in '14 may signal share push
- China scrubs Apple's iPad and MacBooks from government buying list
- Circle the date: Apple's iPhone 6 event slated for Sept. 9
- Stable Mac prices fuel reliable profit engine
- Apple unveils minor bumps to MacBook Pro laptops
- Feds arrest Florida man who allegedly conned Apple out of $309K
- Yosemite's traffic share triples after public beta debuts
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- 5 Ways Dropbox for Business Keeps Your Data Protected Protecting your data isn't a feature on a checklist, something to be tacked on as an afterthought. Download here to find out how...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!